Method SendEmailLoginCode

backend/api/v1/auth_service.go:1628–1664

SendEmailLoginCode sends a 6-digit verification code. Always returns success (no email enumeration). Rate limit: 60-sec resend cooldown enforced atomically via the store — effective cap ≈ 60 sends/hour/email.

(ctx context.Context, req *connect.Request[v1pb.SendEmailLoginCodeRequest])

// (no email enumeration). Rate limit: 60-sec resend cooldown enforced atomically
// via the store — effective cap ≈ 60 sends/hour/email.
func (s *AuthService) SendEmailLoginCode(ctx context.Context, req *connect.Request[v1pb.SendEmailLoginCodeRequest]) (*connect.Response[emptypb.Empty], error) {
	email := strings.ToLower(strings.TrimSpace(req.Msg.Email))
	if email == "" {
		return nil, connect.NewError(connect.CodeInvalidArgument, errors.Errorf("email is required"))
	}
	workspaceID, err := parseOptionalWorkspace(req.Msg.Workspace)
	if err != nil {
		return nil, connect.NewError(connect.CodeInvalidArgument, err)
	}

	// Gate on AllowEmailCodeSignin — no point emailing a code the workspace won't accept.
	// getAccountRestriction handles all cases (including empty workspace for brand-new SaaS
	// signup, where it resolves via EMAIL_CONFIG + SaaS override).
	restriction, err := getAccountRestriction(ctx, s.store, s.licenseService, s.profile.SaaS, workspaceID)
	if err != nil {
		return nil, err
	}
	if !restriction.AllowEmailCodeSignin {
		return nil, connect.NewError(connect.CodeFailedPrecondition, errors.Errorf("email code login is not enabled for this workspace"))
	}

	// Send synchronously so the caller learns about actionable failures (missing EMAIL
	// setting, SMTP unreachable, etc.). No enumeration risk here: LOGIN always attempts to
	// send regardless of whether the email exists (sign-up is handled on verify).
	if err := s.sendEmailVerificationCode(
		ctx,
		req.Msg.Workspace,
		email,
		storepb.EmailVerificationCodePurpose_LOGIN,
		"[Bytebase] Your sign-in code",
		"Hi,\n\nYour sign-in code is: %s\n\nThis code expires in %d minutes. If you didn't request this, you can safely ignore this email.\n\n— Bytebase",
	); err != nil {
		return nil, connect.NewError(connect.CodeInternal, err)
	}

	return connect.NewResponse(&emptypb.Empty{}), nil
}

// resolvePreLoginEmailSetting returns the EMAIL setting to use for unauthenticated flows
// (email-code sign-in, password reset). Resolution order: